CVE-2026-91747 in Chrome
Summary
by MITRE • 09/16/2026
Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as a use-after-free condition within the Skia graphics library, which serves as the core rendering engine for Google Chrome prior to version 153.0.8010.47, represents a critical memory management flaw with significant security implications. This specific defect occurs when the application continues to reference a memory block after it has been freed or reallocated by the system. In the context of browser architecture, Skia handles complex graphical operations such as drawing text, images, and vector graphics on web pages. When an attacker crafts a malicious HTML page that triggers this race condition or improper state management within the rendering pipeline, they can manipulate how memory is accessed after it has been released back to the heap allocator. This scenario allows for arbitrary read or write operations depending on what data subsequently occupies that freed memory space, effectively bypassing standard safety checks and leading to a compromise of the renderer process integrity.
From an operational impact perspective, this vulnerability enables a remote attacker who has already compromised the renderer process through other means, such as exploiting a separate zero-day in JavaScript execution or another component, to escalate their privileges within that sandboxed environment. The primary consequence described is the ability to obtain cross-origin data, which violates the same-origin policy designed to isolate web content from different sources. By leveraging the use-after-free flaw, an attacker can read sensitive information belonging to other websites loaded in adjacent tabs or frames, such as session cookies, authentication tokens, or private user data. This breach of isolation undermines one of the fundamental security models of modern browsers and could potentially serve as a stepping stone for further exploitation attempts against the browser's core components if additional vulnerabilities are chained together.
In terms of industry standard classifications, this vulnerability aligns with CWE-416, which defines use-after-free errors where pointers retain stale references to memory that has been freed. The attack vector is categorized under ATT&CK technique T1059, specifically Command and Scripting Interpreter or potentially T1203 if it involves exploitation for code execution, though the immediate impact here focuses on data exfiltration via cross-origin access. The Chromium security severity rating of High reflects the potential for significant privacy violations and the likelihood that such flaws can be reliably triggered in real-world scenarios through crafted web content. Mitigation strategies primarily involve updating to a patched version of Google Chrome where memory management routines within Skia have been hardened to prevent dangling pointer usage. Additionally, users should ensure they are running with all available security patches applied and consider enabling additional browser sandboxing features or extensions that restrict cross-origin data access as a defense-in-depth measure against similar exploitation attempts.